Re: [rtcweb] [BEHAVE] URI schemes for TURN and STUN

[Marc Petit-Huguenin <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/06/2011 09:59 AM, Ned Freed wrote:
>> On 11/05/2011 04:14 PM, Marc Petit-Huguenin wrote:
>> > -----BEGIN PGP SIGNED MESSAGE-----
>> > Hash: SHA1
>> >
>> > On 11/05/2011 08:04 AM, Gonzalo Salgueiro wrote:
>> >> On Nov 5, 2011, at 10:30 AM, Eric Rescorla wrote:
>> >>
>> >>> On Fri, Nov 4, 2011 at 5:18 PM, Harald Alvestrand<[e-mail]
>> >>> <mailto:[e-mail]>>  wrote:
>> >>>> On 11/04/2011 04:56 PM, Eric Rescorla wrote:
>> >>>>> I don't have any commitment to the scheme. What's the best place?
>> >>>> I like parameters, like this:
>> >>>>
>> >>>> turn://user@host?proto=tcp
>> >>>>
>> >>>> Quite hard to misunderstand, and quite easy to extend.
>> >>>>
>> >>>> (Note: // is only allowed if what follows is [user[:pass]@]host - I don't
>> >>>> recommend using the password, for the obvious reasons, but the syntax will
>> >>>> allow it.)
>> >>> I don't see any security problem with that. The "break old
>> >>> implementations" rationale
>> >>> doesn't apply when we are defining a new URI scheme.
>> >> I agree with this as well.  If we can get some consensus with this, I will
>> >> update the next version of both the STUN and TURN URI Scheme drafts to include
>> >> this format.
>> > Or you can look at draft-petithuguenin-behave-turn-uri-bis, which is already
>> > doing it right (and had a lot of reviews back in 2008, before I split the
>> > resolution mechanism and the syntax in two separate documents).
>> >
>> > I know my email address does not contain the magical "cisco.com", but this is
>> > getting ridiculous.
> 
>> Second opinion: draft-petithuguenin uses TURN and TURNS as scheme names.
>> I still think this is doing it wrong.
> 
> I concur, especially since two different security layers could be used for some
> transports in addition to none at all. The security layer needs to be specified
> as a parameter.

The current syntax was inspired by RFC 3261, but I can put some text about
different syntax in the spec for the purpose of the discussion[1].

What parameter name would you propose for that?


[1] Note that my point of view, and IMO the first thing that should be
discussed, is that a TURN URI is not needed for what RTCWEB wants to do.  Why is
it better to have a URI (on which we cannot put the password anyway), versus
having multiple individual string characters for the security level, transport,
host, port, login and password?

- -- 
Marc Petit-Huguenin
Personal email: [e-mail]
Professional email: [e-mail]
Blog: http://blog.marc.petit-huguenin.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk62wX0ACgkQ9RoMZyVa61cWSgCgnHXs8DWr5BKn1jB9j3+cz5Bf
+68AoI0Uk3+TKbcV5OSlG/zRZD6AIXrg
=tqtp
-----END PGP SIGNATURE-----